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INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 


October  30,  2002 


MEMORANDUM  FOR  DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING 

SERVICE 

SUBJECT :  Report  on  the  Validity  of  Registration  in  the  Central  Contractor 
Registration  Database  (Report  No.  D-2003-018) 


We  are  providing  this  report  for  information  and  use.  We  considered  Defense 
Finance  and  Accounting  Service  comments  on  a  draft  of  this  report  when  preparing  the 
final  report.  The  comments  conformed  to  the  requirements  of  DoD  Directive  7650.3; 
therefore,  additional  comments  are  not  required. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Mr.  Marvin  L.  Peek  at  (703)  604-9587 
(DSN  664-9587)  (mpeek@dodig.osd.mil)  or  Mr.  Jack  L.  Armstrong  at  (317)  510-3846 
(DSN  699-3846)  (jarmstrong@dodig.osd.mil).  See  Appendix  C  for  the  report 
distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


David  K.  Steensma 
Deputy  Assistant  Inspector  General 
for  Auditing 


Office  of  the  Inspector  General  of  the  Department  of  Defense 


Report  No.  D-2003-018  October  30,  2002 

Project  No.  D2000FI-0 15 1.001 

Validity  of  Registration  in  the  Central  Contractor 
Registration  Database 

Executive  Summary 


Who  Should  Read  This  Report  and  Why?  Defense  Finance  and  Accounting  Service 
management  responsible  for  policy  and  procedures  for  paying  contractors  and  vendors, 
and  personnel  responsible  for  making  those  payments  should  read  this  report.  The 
report  identifies  noncompliance  with  the  requirement  that  recipients  of  Government 
funds  be  properly  registered  in  the  Central  Contractor  Registration  database.  Payments 
to  nonregistered  vendors  increase  the  potential  for  fraud  and  hinder  the  efforts  for  debt 
recovery  and  collection  of  income  taxes. 

Background.  DoD  makes  1 1  million  commercial  payments  totaling  more  than 
$150  billion  annually.  In  the  early  1990s  any  contractor  or  vendor  who  wanted  to  do 
business  with  more  than  one  DoD  site  was  required  to  submit  the  same  business 
information  to  each  and  every  site.  To  reform  payment  processes,  DoD  identified  a 
centralized,  electronic  registration  process  known  as  Central  Contractor  Registration 
database  as  the  single  point  of  entry  for  vendors  that  want  to  do  business  with  DoD. 
Because  DoD  is  the  largest  purchaser  of  goods  and  services  in  the  world,  there  was  a 
cost  savings  to  be  realized  by  streamlining  these  administrative  processes.  The  Central 
Contractor  Registration  database  was  created  to  be  the  single  repository  of  vendor  data 
for  the  entire  DoD  to  avoid  this  administrative  duplication  and  allow  contractors  to  take 
responsibility  for  the  accuracy  of  their  own  important  business  information  by 
supplying  it  directly  to  the  Government  through  a  single  registration. 

We  compared  data  available  in  the  Central  Contractor  Registration  database  during  the 
month  of  June  2001  with  data  available  in  the  payment  system  databases  from  March 
through  July  of  2001.  Approximately  one  third  of  the  payments  were  made  to 
contractors  or  vendors  whose  identity  codes  did  not  match  the  identity  codes  listed  in 
the  Central  Contractor  Registration  database.  We  considered  the  mismatched  identity 
codes  an  indicator  of  increased  risk  that  those  contractors  did  not  have  valid  tax 
identification  numbers  listed  in  the  Central  Contractor  Registration  database. 

Results.  DoD  did  not  adequately  implement  a  recommendation  in  a  prior  audit  report 
requiring  contracting  officers  to  obtain  tax  identification  numbers  and  provide  them  to 
DoD  paying  offices.  A  judgmental  review  of  4,607  payments  with  mismatched  identity 
codes  showed  1,297  payments,  totaling  $270.4  million,  were  made  to  contractors  and 
vendors  that  were  not  properly  registered  in  the  Central  Contractor  Registration 
database  at  the  time  of  payment.  As  a  result,  the  tax  identification  numbers  were  not 
available  to  report  contractor  and  vendor  payments  to  the  Internal  Revenue  Service  for 
income  taxes  and  for  debt  recovery.  The  lack  of  taxpayer  identification  number 
information  also  exposed  the  payment  systems  to  potential  fraud.  If  the  DoD  withheld 
payment  from  contractors  and  vendors  who  are  not  properly  registered  in  the  Central 
Contractor  Registration  database,  it  would  motivate  contractors  and  vendors  to  ensure 
the  availability  of  correct  tax  identification  information  (finding  A) . 


A  judgmental  review  of  1,033  vendor  payments  made  between  March  and  July  2001 
showed  that  the  Defense  Finance  Accounting  Service  made  327  check  payments  for 
$1.2  million  that  should  have  been  made  by  electronic  funds  transfer.  Defense  Finance 
Accounting  Service  also  made  18  payments  totaling  $126,694  by  check  that  should  have 
been  made  using  the  Online  Payments  and  Collection  System.  As  a  result,  the  Defense 
Finance  Accounting  Service  payment  processes  were  not  in  full  compliance  with 
Title  31,  United  States  Code  3332  and  are  incurring  higher  costs  for  making  payments 
by  check.  Requiring  that  all  contractors  and  vendors  be  properly  registered  in  the 
Central  Contractor  Registration  database  and  paid  by  electronic  funds  transfer  would 
meet  the  intent  of  the  United  States  Code,  reduce  error,  and  save  time  and  money 
(finding  B). 

Management  Comments.  The  Director,  Commercial  Pay  Services  at  Defense  Finance 
and  Accounting  Service  concurred  and  agreed  that  a  method  or  process  is  needed  to 
ensure  that  the  Government’s  interest  is  protected  from  unlawful  misappropriation  of 
funds,  and  proper  tax  liabilities  are  assessed  when  disbursements  are  made  to 
contractors  or  vendors.  The  Director  agreed  to  use  an  existing  query  application 
specific  to  contractor  pay  to  extract  an  exception  report  for  contractors  not  properly 
registered  in  the  Central  Contractor  Registration  database.  The  Director  also  agreed  to 
refine  and  continuously  monitor  the  manual  processes  related  to  ensuring  that  vendors 
are  properly  registered  with  a  valid  tax  identification  number  in  the  Central  Contractor 
Registration  database.  Management  actions  are  to  be  completed  by 
December  31,  2002.  See  the  Management  Comments  section  for  the  complete  text  of 
management  comments. 


Table  of  Contents 


Executive  Summary  i 

Background  1 

Objectives  2 

Findings 

A.  Validity  of  Registration  in  the  Central  Contractor  Registration 

Database  4 

B.  Payments  Using  Electronic  Funds  Transfer  9 

Appendixes 

A.  Scope  and  Methodology  13 

Management  Control  Program  Review  15 

B.  Prior  Coverage  17 

C.  Report  Distribution  18 

Management  Comments 


Defense  Finance  and  Accounting  Service 


21 


Background 


Central  Contractor  Registration.  DoD  makes  1 1  million  commercial 
payments  totaling  more  than  $150  billion  annually.  In  the  early  1990s,  any 
contractor  or  vendor  who  wanted  to  do  business  with  more  than  one  DoD  site 
was  required  to  submit  the  same  business  information  to  each  individual  site. 
This  redundancy  of  paperwork  not  only  created  an  administrative  burden  for  the 
Government  and  the  vendor,  but  also  was  a  major  source  of  administrative  error 
and  expense  in  terms  of  both  time  and  money.  As  a  result,  the  President  issued 
a  memorandum  in  October  1993  mandating  that  Government  reform  its 
acquisition  processes.  Subsequently,  the  Federal  Acquisition  Streamlining  Act 
of  1994  was  passed,  requiring  the  establishment  of  a  “single  face  to  industry.” 

To  reform  payment  processes,  DoD  identified  a  centralized,  electronic 
registration  process  known  as  the  Central  Contractor  Registration  (CCR) 
database  as  the  single  point  of  entry  for  vendors  that  want  to  do  business  with 
DoD.  The  CCR  database  was  created  to  be  the  single  repository  of  vendor  data 
for  the  entire  DoD  to  avoid  duplicate  reporting  of  business  information  and 
allow  contractors  to  take  responsibility  for  the  accuracy  of  their  own  important 
business  information  by  supplying  it  directly  to  the  Government  through  a  single 
registration.  Because  DoD  is  the  largest  purchaser  of  goods  and  services  in  the 
world,  cost  savings  should  be  achieved  by  streamlining  these  administrative 
processes. 

Corporate  Electronic  Funds  Transfer.  The  Corporate  Electronic  Funds 
Transfer  database  is  a  staging  table  located  on  a  platform  in  Columbus,  Ohio, 
that  receives  files  from  the  CCR  database  and  transmits  interface  files  to 
entitlement  and  DoD  disbursing  systems.  The  Corporate  Electronic  Funds 
Transfer  allows  a  single  source  of  information  to  be  shared  by  all  entitlement 
and  DoD  disbursing  systems,  thereby  streamlining  the  electronic  funds 
enrollment  and  payment  processes. 

Vendor  Pay  Inquiry  System.  The  Vendor  Pay  Inquiry  System  (VPIS)  and 
Mechanization  of  Contract  Administration  Services  (MOCAS)  VPIS  are  two 
separate  applications  developed  for  the  convenience  of  contractors  and  vendors 
doing  business  with  the  DoD.  The  VPIS  and  MOCAS  VPIS  interactively 
provide  information  on  invoices  submitted  against  DoD  contracts  that  Defense 
Finance  and  Accounting  Service  (DFAS)  is  responsible  for  paying.  These 
systems  consolidated  the  contract  data  obtained  from  the  DFAS  sites  into  one 
central  repository  that  contains  all  open  contracts,  plus  any  payments  made 
within  the  last  90  days. 

Commercial  Pay  Business  Line.  DoD  makes  commercial  payments  through 
the  Commercial  Pay  Business  Line.  DFAS  capitalized  all  commercial  payment 
resources  under  the  Commercial  Pay  Business  Line,  effective  April  1,  2001. 

The  Commercial  Pay  Business  Line  includes  DFAS  personnel  performing 
contract,  vendor,  and  transportation  pay  as  well  as  contract  debt  management 
functions.  The  Commercial  Pay  Business  Line  includes  two  product  lines: 
contract  pay  and  vendor  pay. 
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Contract  Pay  Product  Line.  The  Contract  Pay  Product  Line 
encompasses  the  payment  of  contractors  through  formal  long-term  contractual 
instruments.  These  contracts  are  typically  administered  by  the  Defense  Contract 
Management  Agency.  The  Contract  Pay  Product  Line  makes  payments  using 
the  MOCAS  in  Columbus,  Ohio. 

Vendor  Pay  Product  Line.  The  Vendor  Pay  Product  Line  encompasses 
entitlement  determination  for  contracts  not  administered  by  Defense  Contract 
Management  Agency,  transportation  payments,  and  miscellaneous  payments  to 
businesses  and  individuals.  Vendor  payments  are  made  at  23  DFAS  locations 
using  14  different  systems  including  Computerized  Accounts  Payable  System  for 
Windows,  Defense  Integrated  Subsistence  Management  System,  Integrated 
Accounts  Payable  System,  and  Standard  Accounting  and  Reporting  System. 

Tax  Identification  Number.  Tax  Identification  Numbers  (TINs)  are  9-digit 
identifying  numbers  used  by  individuals  and  companies  for  income  tax  purposes. 
Every  contractor  and  vendor  doing  business  with  the  DoD  is  required  to  furnish 
its  TIN  under  section  7701,  title  31,  United  States  Code,  (31  U.S.C  7701) 
(1999).  The  TIN  is  a  mandatory  requirement  for  registration  in  the  CCR  and 
must  be  provided  in  order  to  have  a  valid  CCR  registration. 

Contractor  and  Government  Entity  Code.  The  Contractor  and  Government 
Entity  (CAGE)  Code  is  a  five-character  identification  number  used  extensively 
within  DoD.  CAGE  Codes  are  used  to  support  a  variety  of  mechanized  systems 
throughout  the  Government  and  provide  a  standardized  method  of  identifying  a 
given  facility  at  a  specific  location.  The  Defense  Logistics  Information  Service 
in  Battle  Creek,  Michigan  is  the  only  authorized  source  of  CAGE  Codes. 
Contractors  and  vendors  with  assigned  CAGE  codes  were  not  always  registered 
in  the  CCR  database,  which  was  indicative  of  a  need  for  tighter  management 
controls.  We  considered  the  payments  where  the  CAGE  Codes  in  the  payment 
systems  did  not  match  the  CAGE  Codes  in  the  CCR  database  to  be  a  high-risk 
indicator  of  the  contractor  not  having  a  valid  TIN  registered  in  the  CCR 
database.  For  greater  detail  about  the  transactions  we  reviewed,  based  on 
CAGE  Codes,  see  the  methodology  discussion  in  Appendix  A. 


Objectives 


This  is  the  second  and  final  report  on  the  “Audit  of  Controls  over  Tax 
Identification  Numbers.”  The  first  Report,  No.  D-2001-114,  “DoD  Contractor 
Debt  Collection  Process,”  May  7,  2001,  evaluated  the  controls  associated  with 
the  List  of  Contractors  Indebted  to  the  United  States.  The  objective  of  the 
current  audit  was  to  follow  up  on  Recommendation  1  of  Inspector  General  of  the 
Department  of  Defense  (IG  DoD)  Audit  Report  No.  95-234,  “Department  of 
Defense  Compliance  with  Federal  Tax  Reporting  Requirements,” 

June  14,  1995.  Recommendation  1  required  the  DoD  to  establish  management 
controls  to  assure  that  contracting  officers  obtain  TINs  and  provide  them  to 
DoD  paying  offices.  Specifically,  the  audit  determined  the  validity  of  the 
contractor’s  registration  in  the  CCR  database  at  the  time  of  payment  and 
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whether  the  TIN  was  included  in  the  payment  system.  We  also  evaluated  the 
effectiveness  of  the  management  control  program  as  it  related  to  the  audit 
objective. 

The  audit  announcement  included  a  third  primary  objective  to  follow  up  on 
Recommendations  B.2.a.  of  IG  DoD  Audit  Report  No.  96-038,  “Debt 
Collection  and  Deposit  Controls  in  the  Department  of  Defense” 

December  11,  1995.  Recommendation  B.2.a.  required  the  establishment  of 
performance  standards  for  critical  debt  collection  techniques.  The  third 
objective  was  not  accomplished  because  DoD  had  implemented  a  new 
Contractor  Debt  Management  System  and  it  was  too  early  to  perform  a 
follow-up  audit.  See  Appendix  A  for  a  discussion  of  the  audit  scope, 
methodology,  and  our  review  of  the  management  control  program.  See 
Appendix  B  for  prior  coverage. 
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A.  Validity  of  Registration  in  the  Central 
Contractor  Registration  Database 

DoD  did  not  adequately  implement  our  recommendation  from  a 
previous  audit  report  requiring  contracting  officers  to  obtain  TINs 
and  provide  them  to  DoD  paying  offices.  A  judgmental  review  of 
4,607  payments  with  mismatched  identity  codes  showed 
1,297  payments,  totaling  $270.4  million,  were  made  to  contractors 
and  vendors  that  were  not  properly  registered  in  the  Central 
Contractor  Registration  database  at  the  time  of  payment.  DFAS 
made  these  payments  to  contractors  and  vendors  without  proper 
registrations  because  DFAS  personnel  did  not  always  review  the 
CCR  database  before  making  payments.  As  a  result,  the  tax 
identification  numbers  were  not  available  for  proper  reporting  of 
contractor  and  vendor  payments  for  income  taxes  and  for  debt 
recovery. 

CCR  Database  Requirements 


Defense  Federal  Acquisition  Regulation  Supplement  (DFARS)  subpart  204.73, 
“Central  Contractor  Registration,”  March  16,  2000,  prescribes  requirements, 
policies,  and  procedures  for  contractor  registration  in  the  DoD  CCR  database  to 
comply  with  the  Debt  Collection  Improvement  Act  of  1996.  Prospective 
contractors  must  be  registered  in  the  CCR  database  prior  to  award  of  a  contract, 
basic  agreement,  basic  ordering  agreement,  or  blanket  purchase  agreement. 
Exceptions  to  this  requirement  include  the  following: 

•  purchases  paid  for  with  a  Government-wide  commercial  purchase 
card; 

•  awards  made  to  foreign  vendors  for  work  performed  outside  the 
United  States; 

•  classified  contracts  or  purchases  when  registration  in  the  CCR 
database,  or  use  of  CCR  data,  could  compromise  the  safeguarding  of 
classified  information  or  national  security; 

•  contracts  awarded  by  deployed  contracting  officers  in  the  course  of 
military  operation;  and 

•  purchases  to  support  unusual  or  compelling  needs  of  the  type 
described  in  Federal  Acquisition  Regulation  6.302-2,  “Unusual  and 
Compelling  Urgency.  ” 

DFARS  252.204-7004,  “Required  Central  Contractor  Registration,”  states  that 
by  submission  of  an  offer,  the  offeror  acknowledges  the  requirement  that  a 
prospective  awardee  must  be  registered  in  the  CCR  database  prior  to  award, 
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during  performance,  and  through  final  payment  of  any  contract  resulting  from 
this  solicitation,  except  for  awards  to  foreign  vendors  for  work  to  be  performed 
outside  the  United  States. 

DFARS  252.204-7004  also  states  that  the  contractor  is  responsible  for  the 
accuracy  and  completeness  of  the  data  within  the  CCR  database,  and  for  any 
liability  resulting  from  the  Government’s  reliance  on  inaccurate  or  incomplete 
data.  To  remain  registered  in  the  CCR  database  after  the  initial  registration,  the 
contractor  is  required  to  confirm  annually  that  its  information  in  the  CCR 
database  is  accurate  and  complete. 


CCR  Database  Registration  at  the  Time  of  Payment 


DoD  did  not  adequately  implement  Recommendation  1  in  IG  DoD  Report 
No.  95-234,  “Department  of  Defense  Compliance  with  Federal  Tax  Reporting 
Requirements,”  June  14,  1995.  Recommendation  1  required  contracting 
officers  to  obtain  TINs  and  provide  them  to  DoD  paying  offices.  A  judgmental 
review  of  4,607  payments  DFAS  made  between  March  and  July  2001  showed 
1,297  payments,  totaling  $270.4  million,  were  made  to  contractors  and  vendors 
that  were  not  properly  registered  in  the  CCR  database  at  the  time  of  payment. 
The  4,607  commercial  payments,  totaling  $460.0  million,  were  considered  to  be 
at  a  higher  risk  for  improper  registration  in  the  CCR  database  because  the 
CAGE  Codes  in  the  payment  systems  and  the  June  2001  CCR  database  did  not 
match.  These  contractors  and  vendors  were  not  registered  in  the  CCR  database, 
their  registration  had  expired  in  the  CCR  database,  their  registration  was 
incomplete,  or  their  registration  had  been  deleted  at  the  time  of  payment. 

Table  1  identifies  the  status  of  contractors’  and  vendors’  registrations  in  the 
CCR  database  for  the  payments  we  reviewed. 


Table  1.  Status  of  Registration  in  the  CCR  Database 

Classification  of 
Payments 

Number  of  Payments 
Reviewed 

Percentage  of  Total 
Payments  Reviewed1 

Invalid  Registration 

985 

21.4 

Expired  Registration 

312 

6.7 

Sub-total 

1,297 

28.1 

Valid  Registration 

2,887 

62.7 

Registration  Not 
Required 

423 

9.2 

Total 

4,607 

100.0 

These  percentages  cannot  be  projected  to  the  total  population  of  376,284  payments  with 
mismatched  contractor  identity  codes  discussed  in  Appendix  A. 
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Invalid  Registration.  There  were  985  payments  (21.4  percent)  made  to 
contractors  and  vendors  whose  CCR  registrations  were  invalid  at  the  time  of 
payment.  Of  the  985  payments,  40  payments  went  to  contractors  that  did  not 
have  complete  registrations  in  the  CCR  database.  There  were  930  payments 
made  despite  the  fact  that  the  CAGE  Code  and  the  contractor  or  vendor  name 
were  not  registered  in  the  CCR  database  at  the  time  of  payment.  For  example, 
the  DFAS  San  Bernardino  Vendor  Pay  Site  paid  a  company  on  March  29,  2001, 
although  the  company  was  not  registered  in  the  CCR  database.  The  company 
did  not  register  in  the  CCR  database  until  May  10,  2001.  There  were 
13  payments  made  to  contractors  that  had  an  obsolete  CAGE  Code  and  did  not 
have  another  CAGE  Code  registered  in  the  CCR  database  at  the  time  of 
payment.  For  the  remaining  two  payments,  the  vendor  had  deleted  their 
registration  in  the  CCR  database.  For  example,  DFAS  San  Diego  paid  a  vendor 
on  April  10,  and  May  25,  2001,  although  the  CCR  database  showed  that  the 
vendor’s  registration  was  deleted  on  November  17,  2000.  DFAS  personnel  did 
not  check  the  registration  in  the  CCR  database  prior  to  making  payments. 

These  payments  should  not  have  been  made  until  the  contractor  or  vendor  was 
properly  registered  in  the  CCR  database. 

Expired  Registration.  There  were  312  payments  (6.7  percent)  made  to 
contractors  and  vendors  whose  registrations  were  expired  in  the  CCR  database 
at  the  time  of  payment.  The  contractors  or  vendors  had  valid  registrations  in  the 
CCR  database  at  one  time,  but  the  registrations  expired  before  the  payment  was 
made.  These  payments  should  not  have  been  made  until  the  contractor  had  a 
valid  registration.  For  example,  the  DFAS  Columbus  Vendor  Pay  Site  paid  a 
company  on  March  22,  2001,  although  their  CCR  database  registration  had 
expired  on  May  6,  2000.  This  payment  was  made  320  days  after  registration  in 
the  CCR  database  expired.  Payments  were  made  to  contractors  and  vendors 
with  expired  registrations  because  DFAS  personnel  did  not  check  the  CCR 
database  registration  before  the  payments  were  made.  In  accordance  with 
DFARS  252.204-7004,  contractors  and  vendors  are  required  to  be  registered  in 
the  CCR  database  through  final  payment  on  the  contract. 

Valid  Registration.  There  were  2,887  payments  (62.7  percent)  made  to 
contractors  and  vendors  with  valid  registrations  in  the  CCR  database  at  the  time 
of  payment.  Of  the  2,887  payments,  821  payments  were  considered  to  have  a 
valid  registration  with  the  same  CAGE  Code  that  was  in  the  payment  system. 
There  were  302  payments  where  the  contractor  or  vendor  had  a  registration  that 
was  valid  in  the  CCR  database  at  the  time  of  payment  but  under  a  replacement 
CAGE  Code.  The  remaining  1,764  payments  were  made  to  contractors  or 
vendors  that  had  a  valid  registration  in  the  CCR  database  at  the  time  of  payment 
but  under  a  CAGE  Code  different  from  that  in  the  payment  system. 

Registration  Not  Required.  There  were  423  payments  (9.2  percent)  made  to 
recipients  not  required  to  register  in  the  CCR  database.  Of  the  423  payments, 
255  payments  were  made  to  foreign  contractors.  We  could  not  determine  the 
status  of  6  payments.  The  remaining  162  payments  were  considered 
miscellaneous  payments  for  training,  legal  claims,  casualties,  suggestion 
awards,  and  uniforms. 
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TIN  Availability 


The  payment  systems  did  not  always  include  the  TIN  because  DFAS  personnel 
were  not  reviewing  the  CCR  database  before  making  payments.  DFAS  did  not 
have  procedures  in  place  requiring  that  payments  be  withheld  until  contractors 
and  vendors  updated  the  CCR  database;  therefore,  there  was  no  incentive  for 
DFAS  personnel  to  review  the  CCR  database.  Our  sample  included 
2,089  contract  and  vendor  payments  that  did  not  include  the  TIN  in  the  payment 
systems  and  therefore  lacked  TIN  information  for  proper  reporting  of  contractor 
and  vendor  payments  for  income  tax  purposes  and  possible  debt  recovery. 

The  action  DoD  took,  establishing  CCR,  to  implement  Recommendation  1  in 
Audit  Report  No.  95-234  was  not  fully  effective  because  essential  management 
controls  were  not  in  place.  The  lack  of  TIN  information  also  exposed  the 
payment  systems  to  potential  fraud.  We  documented  acts  of  potential  fraud  by 
contractors  and  vendors  providing  invalid  TINs  in  the  CCR  database.  We 
referred  183  cases  of  possible  fraudulent  actions  to  the  Defense  Criminal 
Investigative  Service  for  investigation  on  October  29,  2001.  DFAS  needs  to 
withhold  payments  to  contractors  and  vendors  when  processing  payments  with 
missing  or  inaccurate  TIN  information. 


Subsequent  DoD  Actions 


In  March  2002,  the  Under  Secretary  of  Defense  (Comptroller)  issued  DoD 
Regulation  7000. 14-R,  “Financial  Management  Regulation,”  volume  10, 
chapter  1,  “Financial  Control  of  Vendor  and  Contract  Payments”  regarding 
registration  in  the  CCR  and  electronic  funds  transfer  (EFT)  payments.  This 
guidance  allows  DFAS  to  charge  additional  fees  to  DoD  Components  until  the 
DoD  Component  ensures  that  the  contract  includes  the  clauses  providing  for 
CCR  database  registration  and  payment  by  EFT.  However,  these  procedures 
will  not  be  effective  if  DFAS  personnel  do  not  verify  that  valid  TINs  are  in  the 
payment  systems  and  withhold  payments  until  contractors  and  vendors  are 
properly  registered  in  the  CCR  database. 


Recommendation  and  Management  Comments 

A.  We  recommend  that  the  Director,  Commercial  Pay  Services,  Defense 
Finance  and  Accounting  Service  establish  procedures  to  withhold  payments 
to  contractors  and  vendors  until  they  are  properly  registered  with  a  valid 
Tax  Identification  Number  in  the  Central  Contractor  Registration  database. 

Management  Comments.  DFAS  concurred  and  agreed  that  a  method  or 
process  is  needed  to  ensure  that  the  Government’s  interest  is  protected  from 
unlawful  misappropriation  of  funds  and  proper  tax  liabilities  are  assessed  when 
disbursements  are  made  to  contractors  or  vendors.  DFAS  agreed  to  use  an 
existing  query  application  specific  to  contractor  pay  to  extract  an  exception 
report  for  contractors  not  properly  registered  in  the  Central  Contractor 
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Registration  database.  The  exception  report  will  be  the  basis,  after  verification 
with  the  CCR,  of  withholding  contractor  payments.  DFAS  also  agreed  to  refine 
and  continuously  monitor  the  manual  processes  related  to  ensuring  that  vendors 
are  properly  registered  with  a  valid  TIN  in  the  CCR  database.  Management 
actions  are  scheduled  to  be  completed  by  December  31,  2002.  See  the 
Management  Comments  section  for  the  complete  text  of  management  comments. 
See  Appendix  A,  Management  Control  Program  Review,  for  additional 
management  comments  concerning  the  material  management  control  weakness. 
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B.  Payments  Using  Electronic  Funds 
Transfer 

A  judgmental  review  of  1,033  vendor  payments  DFAS  made  by  check 
showed  that  345  should  have  been  made  by  electronic  funds  transfer 
(EFT).  The  1,033  vendor  payments  were  made  between  March  and 
July  2001.  Specifically,  DFAS  made  327  check  payments  for 
$1.2  million  that  should  have  been  made  by  EFT.  DFAS  also  made 
18  payments  totaling  $126,694  by  check  that  should  have  been  made 
using  the  Online  Payments  and  Collection  System.  DFAS  guidance  for 
implementing  EFT  payments  was  inadequate  and  contained  EFT  payment 
exemptions  that  were  not  consistent  with  statutory  requirements.  As  a 
result,  DFAS  payment  processes  were  not  in  full  compliance  with 
Title  31,  U.S.C.  3332.  Also,  DFAS  incurred  higher  administrative  costs 
making  payments  by  check. 


EFT  Requirements 


The  Debt  Collection  Improvement  Act  of  1996,  as  codified  in  31  U.S.C. 

Section  3332,  “Required  Direct  Deposit,”  requires  that  all  Federal  payments 
made  after  January  1,  1999,  be  made  using  EFT  unless  a  payment  meets 
specific  waiver  requirements.  EFT  is  defined  as  any  transfer  of  funds  other 
than  a  transaction  originating  by  cash,  check  or  similar  paper  instrument.  The 
Department  of  Treasury  in  31  Code  of  Federal  Regulations  (C.F.R.)  Subpart 
208.3,  “Payment  by  Electronic  Funds  Transfer,”  and  Subpart  208.4, 

“Waivers,”  allows  specific  waivers  to  the  EFT  requirements.  The  Federal 
Acquisition  Regulation  subpart  32.11,  “Electronic  Funds  Transfer,”  requires 
that  EFT  be  used  for  making  contract  payments.  Based  on  these  criteria,  most 
payments  we  reviewed  should  have  been  made  using  EFT. 

Federal  Payment  Defined.  31  C.F.R.  Section  208.2  defines  Federal  payment 
as  including,  but  not  limited  to: 

•  Federal  wage,  salary,  and  retirement  payments; 

•  vendor  and  expense  reimbursement  payments; 

•  benefit  payments;  and 

•  miscellaneous  payments  such  as  interagency  payments;  grants;  loans; 
fees;  principal,  interest,  and  other  payments  related  to  U.S. 
marketable  and  nonmarketable  securities;  overpayment 
reimbursements;  and  payments  under  Federal  insurance  or  guarantee 
programs  for  loans. 
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EFT  Waivers.  31  C.F.R.  Section  208.4  allows  waivers  of  the  EFT 
requirement  when: 


•  an  individual  determines  that  payment  by  EFT  would  impose  a 
hardship; 

•  the  infrastructure  in  a  foreign  country  does  not  support  payment  by 
EFT; 

•  the  payment  is  to  a  recipient  within  a  disaster  area; 

•  a  military  operation  or  a  call  to  order  to  active  duty  members  of  the 
uniformed  services  is  made  during  a  war  or  national  emergency; 

•  a  threat  may  be  posed  to  national  security; 

•  the  agency  does  not  expect  to  make  more  than  one  payment  to  the 
same  recipient  within  a  one-year  period;  and 

•  an  agency's  need  for  goods  or  services  is  of  such  unusual  and 
compelling  urgency,  or  there  is  only  one  source  of  goods  or  services, 
that  the  Government  would  be  seriously  injured  unless  payment  is 
made  by  a  method  other  than  EFT. 


Method  of  Payment 


A  judgmental  review  of  1,033  vendor  payments  DFAS  made  by  check  showed 
that  345  should  have  been  made  by  EFT.  DFAS  made  the  payments  between 
March  and  July  2001.  Of  the  345  improper  check  payments,  327  payments 
totaling  $1.2  million  were  made  by  check  instead  of  EFT.  The  327  check 
payments  did  not  meet  waiver  requirements  contained  in  31  C.F.R. 

Section  208.4.  DFAS  also  made  18  payments  for  $126,694  by  check  that 
should  been  have  made  using  the  Online  Payments  and  Collection  System.  The 
Online  Payments  and  Collection  System  is  an  automated  means  by  which  billing 
information  is  transmitted  between  Federal  agencies  through  a  commercial  time¬ 
sharing  service  by  way  of  a  telecommunications  network.  Table  2  shows  the 
methods  of  payment  for  the  1,033  payments  reviewed. 
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Table  2.  Methods  of  Payment 

Classification  of  Payments 

Number  of 
Payments 

Percentage  of 
Payments2 

Improper  Check  Payments 

Vendors  properly  registered  in  CCR 

76 

Vendors  not  registered  in  CCR 

126 

Payments  to  individuals 

76 

Payments  to  Government  Agencies 

67 

Number  of  Improper  Check  Payments 

345* 

33.4 

Method  of  payment  could  not  be  determined 

2 

0.2 

Proper  Check  Payments 

17 

1.6 

EFT  Payments 

669 

64.8 

Total 

1,033 

100.0 

♦Represents  327  payments  that  should  have  been  made  by  EFT  and  18  payments  to 
Federal  agencies  that  should  have  been  made  using  die  Online  Payment  and  Collection 

System. 

Vendors  Properly  Registered.  Vendors  for  76  of  the  improper  check  payments 
were  registered  in  the  CCR  database  and  the  EFT  information  was  included  with 
their  CCR  registration.  DFAS  personnel  did  not  check  the  CCR  database  to 
determine  if  the  vendors  were  registered.  For  example,  DFAS  San  Bernardino 
made  a  payment  to  a  vendor  by  check  on  April  11,  2001.  The  vendor  had  an 
active  registration  in  the  CCR  that  was  valid  through  August  11,  2001  and 
should  have  been  paid  using  EFT. 

Vendors  Not  Registered.  Vendors  for  126  of  the  improper  check  payments 
were  not  properly  registered  in  the  CCR  database.  DFAS  should  not  have  made 
payments  to  vendors  that  were  not  registered  in  the  CCR  database.  DFAS  did 
not  ensure  that  contractors  and  vendors  receiving  miscellaneous  payments  were 
properly  registered  in  the  CCR  database  so  payments  could  be  made  using  EFT. 
The  DoD  Regulation  7000. 14-R,  “Financial  Management  Regulation,” 
volume  10,  chapter  12,  “Miscellaneous  Payments”  includes  payments  made  to 
individuals,  telephone  companies,  and  bankcard  service  companies. 

Payments  to  Individuals.  Government  employees  received  76  of  the  improper 
check  payments  that  should  have  been  made  using  EFT.  As  Federal  employees, 
they  would  already  receive  Federal  salary  payments  by  EFT.  DFAS  did  not  use 
this  available  information  before  making  the  76  check  payments. 


2The  percentages  for  the  classification  payments  are  related  to  die  total  1,033  payments  sampled 
and  cannot  be  projected  to  the  population  of  payments  that  the  sample  was  selected. 
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Payments  to  Other  Government  Agencies.  DFAS  made  67  improper  check 
payments  to  other  Government  agencies.  The  Online  Payment  and  Collection 
System  should  have  been  used  for  18  of  the  payments  made  to  Federal  agencies. 
The  remaining  49  payments  were  made  to  state  and  local  governments  and 
should  have  been  made  by  EFT. 

Method  of  Payment  Could  not  be  Determined.  For  two  of  the  payments, 
DFAS  personnel  were  unable  to  provide  documentation. 


DFAS  Payment  Guidance 

The  DFAS  guidance  of  January  27,  2000,  mandating  EFT  payments  was 
inadequate.  The  DFAS  guidance  implemented  guidance  in  a 
December  30,  1999,  Under  Secretary  of  Defense  (Comptroller)  memorandum 
mandating  EFT  payments.  However,  the  DFAS  guidance  included  exemptions 
that  were  not  included  or  incorporated  in  the  31  C.F.R.  208.4.  Those  DFAS 
exemptions  included  payments  to  the  following: 

•  sole  proprietors, 

•  utility  companies,  and 

•  common  carriers  under  Government  bills  of  lading. 

Conclusion 


The  purpose  of  making  EFT  payments  is  to  avoid  administrative  errors  and  to 
save  time  and  money.  DFAS  vendor  pay  sites  were  not  consistent  in 
implementing  the  DFAS  and  DoD  guidance.  For  example,  DFAS  Norfolk  in 
Norfolk,  Virginia,  paid  a  vendor  by  EFT  while  DFAS  Limestone  in  Limestone, 
Maine,  paid  the  same  vendor  by  check.  IG  DoD  Report  No.  D-2002-113, 
“Controls  Over  the  Computerized  Accounts  Payable  System  at  Defense  Finance 
and  Accounting  Service  Columbus,”  June  21,  2002,  included  recommendations 
that  DFAS  make  all  payments  by  EFT  unless  properly  waived  and  that 
contractors  and  vendors  receiving  miscellaneous  payments  are  properly 
registered  in  CCR.  The  Office  of  the  Under  Secretary  of  Defense  (Comptroller) 
concurred  with  the  recommendations  and  updated  volume  10,  chapter  1,  of  the 
DoD  Regulation  7000. 14-R.  The  updated  chapter  requires  the  use  of  EFT  for 
all  payments  using  vendor  pay  systems  unless  the  requirement  is  properly 
waived  in  accordance  with  31  C.F.R.  section  208.4.  Therefore,  we  did  not 
include  any  recommendations  on  making  EFT  payments  in  this  report. 


12 


Appendix  A.  Scope  and  Methodology 


DFAS  makes  11  million  commercial  payments  for  more  than  $150  billion, 
annually.  In  IG  DoD  Report  No.  95-234,  “Department  of  Defense  Compliance 
With  Federal  Tax  reporting  Requirements,”  June  14,  1995,  we  reported  that 
DoD  contracting  offices  were  not  obtaining  contractor  payment  information  or 
maintaining  accurate  records  needed  for  tax  reporting.  The  purpose  of  this  audit 
was  to  review  DoD  implementation  of  Recommendation  1  in  Audit  Report 
No.  95-234,  requiring  contracting  officers  to  obtain  TINs  and  provide  them  to 
DoD  paying  offices.  Contractors  and  vendors  are  now  required  to  register  in 
the  CCR  database  before  award  of  a  contract  and  DFAS  can  review  the  CCR 
database  for  the  TIN.  Therefore,  we  judgmentally  reviewed  4,607  payments 
totaling  $460.0  million  made  between  March  and  July  2001  using  contract  and 
vendor  pay  systems.  We  limited  our  review  to  the  validity  of  the  contractor  and 
vendor  registration  in  the  CCR  database  at  the  time  of  payment  and  whether  the 
TIN  was  included  in  the  payment  system. 

We  reviewed  the  June  2001  CCR  database  and  identified  potential  acts  of  fraud. 
We  documented  acts  of  potential  fraud  by  contractors  and  vendors  providing 
invalid  TINs  in  the  CCR  database.  We  referred  183  cases  of  possible  fraudulent 
activity  to  the  Defense  Criminal  Investigative  Service  on  October  29,  2001. 

The  Defense  Criminal  Investigative  Service  is  investigating  the  cases. 

We  obtained  payment  data  (1,096,160  payments)  from  MOCAS  VPIS  and 
VPIS.  The  payments  we  reviewed  were  made  between  March  and  July  2001. 
We  also  obtained  the  May  2000,  and  April  through  July  2001  CCR  databases. 
We  designed  a  query  to  identify  payments  that  were  made  to  contractors  and 
vendors  who  were  not  registered  in  the  June  2001  CCR  database.  We  designed 
the  query  based  on  the  CAGE  Code  because  this  was  a  common  field  between 
the  payment  data  from  MOCAS  VPIS,  VPIS,  and  the  data  in  the  June  2001 
CCR  database.  Our  query  identified  376,284  payments  where  the  CAGE  Code 
in  MOCAS  VPIS  and  VPIS  did  not  match  the  CAGE  Code  in  the  June  2001 
CCR  database.  We  considered  these  payments  to  be  at  higher  risk  for  improper 
registration  in  the  CCR  database.  We  judgmentally  reviewed  4,607  of  these 
payments.  Of  the  4,607  payments  we  reviewed,  3,574  payments  were  made 
through  the  Contract  Pay  Product  Line  and  1,033  payments  were  made  through 
the  Vendor  Pay  Product  Line.  Table  A.  shows  the  payment  sites,  payment 
systems,  and  number  of  payments  reviewed. 
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Table  A.  Pay  Sites,  Pay  Systems,  and  Number  of  Payments  Reviewed 

Pay  Sites 

Pay  System 

Number  Payments 
Reviewed 

Columbus,  Ohio 

MOCAS 

3,574 

Columbus,  Ohio 

DISMS1 

143 

Columbus,  Ohio 

CAPS(W)2 

90 

Norfolk,  Virginia 

CAPS(W) 

100 

Rome,  New  York 

CAPS(W) 

100 

Limestone,  Maine 

I  APS 3 

150 

San  Bernardino,  California 

IAPS 

150 

Charleston,  South  Carolina 

STARS4  One  Pay 

150 

San  Diego,  California 

STARS  One  Pay 

150 

Total 

4,607 

‘Defense  Integrated  Subsistence  Management  System 

2Computerized  Accounts  Payable  System  for  Windows 
integrated  Accounts  Payable  System 

4Standard  Accounting  and  Reporting  System 

We  reviewed  all  the  payments  in  MOCAS  where  the  CAGE  Code  did  not  match 
the  June  2001  CCR  database.  We  used  a  two-stage  sampling  approach  to  select 
vendor  payments  for  review.  We  did  not  include  payments  made  outside  the 
continental  United  States  in  our  sample  selection.  Also,  we  did  not  review 
100  vendor  payments  selected  from  Columbus  Computerized  Accounts  Payable 
System  for  Windows  because  they  were  all  miscellaneous  payments.  We  did 
not  include  our  analysis  of  payments  made  from  the  Automated  Voucher 
Examination  Disbursing  System  because  the  file  included  payments  made  prior 
to  the  establishment  of  the  CCR  database.  We  also  did  not  include  our  analysis 
of  7  payments  from  the  Defense  Integrated  Subsistence  Management  System, 
and  10  payments  from  the  Computerized  Accounts  Payable  System  for  Windows 
(Columbus,  Ohio),  and  1,062  payments  from  MOCAS  because  these  payments 
were  pending  at  the  time  of  our  review.  We  did  not  review  contract  payments 
to  determine  if  they  were  properly  made  using  EFT.  The  sample  selected  could 
not  be  projected  because  the  total  population  could  not  be  determined. 

We  determined  the  status  of  a  contractor’s  or  vendor’s  registration  in  the  CCR 
database  at  the  time  of  payment  by  using  payment  data  we  obtained  from 
MOCAS  VPIS,  VPIS,  the  payment  systems,  and  hardcopy  payment  files  to 
search  the  May  2000,  and  April  through  July  2001  CCR  databases.  We  also 
searched  the  online  version  of  the  CCR  database  for  a  registration  for  the 
contractor  or  vendor.  In  addition,  we  reviewed  laws  and  regulations  applicable 
to  contractor  and  vendor  registration  in  the  CCR  database  and  EFT  payments. 
We  also  interviewed  DFAS  personnel  involved  in  the  payment  process. 
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We  performed  this  audit  from  May  2001  through  July  2002,  in  accordance  with 
generally  accepted  government  auditing  standards. 

Use  of  Technical  Assistance.  We  obtained  assistance  from  the  IG  DoD, 
Quantitative  Methods  Division,  in  selecting  a  judgmental  sample  of  payments  to 
review.  Table  A.  shows  the  number  of  samples  selected  by  pay  location  and 
pay  system.  The  audit  results  were  not  projected  to  the  population. 

Computer-Processed  Data.  We  relied  on  computer-processed  data  from  the 
pay  systems  listed  in  Table  A.  Although  we  did  not  perform  a  formal  reliability 
assessment  of  those  systems,  we  determined  that  the  payment  information  they 
contained  generally  agreed  with  hardcopy  payment  files.  We  did  not  find  any 
errors  that  would  preclude  the  use  of  the  computer-processed  data  to  meet  the 
audit  objectives  or  that  would  change  the  conclusions  in  the  report. 

General  Accounting  Office  High-Risk  Area.  The  General  Accounting  Office 
has  identified  several  high-risk  areas  in  the  DoD.  This  report  provides  coverage 
of  the  Defense  Financial  Management  high-risk  area. 


Management  Control  Program  Review 


DoD  Directive  5010.38  “Management  Control  (MC)  Program,”  August  26, 
1996,  and  DoD  Instruction  5010.40,  “Management  Control  (MC)  Program 
Procedures,”  August  28,  1996,  require  DoD  organizations  to  implement  a 
comprehensive  system  of  management  controls  that  provides  reasonable 
assurance  that  programs  are  operating  as  intended  and  to  evaluate  the  adequacy 
of  the  controls. 

Scope  of  Review  of  the  Management  Control  Program.  We  reviewed  the 
adequacy  of  management  controls  over  DoD  processes  and  procedures  for 
verifying  that  a  contractor  or  vendor  was  registered  in  the  CCR  database  prior 
to  making  payment  at  DFAS  Contract  Pay  and  DFAS  Vendor  Pay  Sites  and  for 
making  payments  by  EFT  at  DFAS  Vendor  Pay  sites.  We  also  reviewed 
management's  self-evaluation  applicable  to  those  controls. 

Adequacy  of  Management  Controls.  We  identified  material  management 
control  weaknesses  as  defined  by  DoD  Instruction  5010.40.  Controls  over  the 
DoD  contract  and  vendor  payment  processes  were  not  adequate  to  ensure  that 
contractors  and  vendors  were  registered  in  the  CCR  database  prior  to  receiving 
payment,  that  vendors  were  paid  by  EFT,  and  that  contractors  posed  a  valid 
TIN  prior  to  payment.  Specifically,  inconsistent  management  controls  between 
the  DoD  payment  sites  allowed  for  inconsistent  payment  practices.  In  addition, 
management  controls  were  not  in  compliance  with  the  Debt  Collection 
Improvement  Act  of  1996  and  the  DoD  Financial  Management  Regulation. 

The  recommendation  in  this  report,  if  implemented,  will  improve  controls  over 
determining  whether  contractors  are  registered  in  the  CCR  database  prior  to 
making  payment.  A  copy  of  the  report  will  be  provided  to  the  senior  official 
responsible  for  management  controls  in  DFAS. 
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Adequacy  of  Management’s  Self-Evaluation.  DFAS  officials  identified 
Contract  Pay  and  Vendor  Pay  as  assessable  units.  However,  in  their  evaluation, 
DFAS  did  not  identify  or  report  the  material  control  weaknesses  that  allowed 
contractors  who  were  not  registered  in  the  CCR  database  to  be  paid  and  that 
allowed  vendors  to  improperly  be  paid  by  check  rather  than  by  EFT. 

In  commenting  on  a  draft  of  this  report,  DFAS  Columbus  Center  non-concurred 
with  our  conclusion  that  the  lack  of  controls  over  the  DoD  contract  and  vendor 
payment  processes  was  a  material  weakness  related  to  the  commercial  pay 
entitlement  process.  However,  DFAS  agreed  that  controls  were  needed  to 
identify  contactors  that  are  not  properly  registered  in  the  CCR  prior  to  payment, 
and  to  ensure  payments  are  withheld  until  proper  registration  is  complete. 

DFAS  plans  to  require  Commercial  Pay  Business  Line  Activities  to  insert  CCR 
controls  in  the  appropriate  assessable  unit  management  control  matrices  to 
ensure  continuous  monitoring  and  compliance  with  the  law  until  the  issue  is 
corrected.  The  management  comments  also  outlined  two  system  changes  that 
will  help  address  the  problem.  See  the  Management  Comments  section  for  a 
complete  text  of  DFAS  comments. 
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Appendix  B.  Prior  Coverage 


During  the  last  5  years,  the  General  Accounting  Office  (GAO)  and  the  IG  DoD 
have  issued  six  reports  discussing  vendor  payments.  Unrestricted  GAO  reports 
can  be  accessed  over  the  Internet  at  http : //www . gao . gov .  Unrestricted  IG  DoD 
reports  can  be  accessed  at  http :  //www .  dodig .  osd .  mil/audit/reports . 


GAO 


GAO  Report  No.  GAO/AIMD-98-274  (OSD  Case  No.  1687),  “Improvements 
Needed  in  Air  Force  Vendor  Payment  Systems  and  Controls,”  September  28, 
1998 

IG  DoD 


IG  DoD  Report  No.  D-2002-113,  “Controls  Over  the  Computerized  Accounts 
Payable  System  at  Defense  Finance  and  Accounting  Service  Columbus,” 

June  21,  2002 

IG  DoD  Report  No.  D-2002-056,  “Controls  Over  Vendor  Payments  Made  for 
the  Army  and  Defense  Agencies  Using  the  Computerized  Accounts  Payable 
System,”  March  6,  2002 

IG  DoD  Report  No.  D-2002-008,  “Controls  Over  the  Computerized  Accounts 
Payable  System  at  Defense  Finance  and  Accounting  Service  Kansas  City,” 
October  19,  2001 

IG  DoD  Report  No.  D-2001-114,  “  DoD  Contractor  Debt  Collection  Process,” 
May  7,  2001 

IG  DoD  Report  No.  D-2000-139,  “Controls  Over  the  Integrated  Accounts 
Payable  System,”  June  5,  2000 

IG  DoD  Audit  Report  No.  96-038,  “Debt  Collection  and  Deposit  Controls  in  the 
Department  of  Defense,”  December  11,  1995 

IG  DoD  Report  No.  95-234,  “Department  of  Defense  Compliance  with  Federal 
Tax  Reporting  Requirements,”  June  14,  1995 
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Appendix  C.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
Director  for  Acquisition  Initiatives 
Director,  Defense  Procurement 

Under  Secretary  of  Defense  (Comptroller)/Chief  Financial  Officer 
Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 

Department  of  the  Navy 

Auditor  General,  Department  of  the  Navy 

Department  of  the  Air  Force 

Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organization 

Director,  Defense  Finance  and  Accounting  Service 

Non-Defense  Federal  Organization 

Office  of  Management  and  Budget 
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Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Efficiency,  Financial  Management,  and 
Intergovernmental  Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  Technology  and  Procurement  Policy,  Committee  on 
Government  Reform 
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Defense  Finance  and  Accounting  Service 
Comments 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 
COLUMBUS 

P.O.  BOX  182317 
COLUMBUS,  OHIO  43218*2317 


DFAS-BS/CC 


sf.p  : 2X2 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  DIRECTORATE, 
OFFICE  OF  THE  INSPECTOR  GENERAL,  DEPARTMENT  OF 
DEFENSE 

SUBJECT:  Management  Comments  to  Department  of  Defense  Inspector  General  (DoD-IG) 
Draft  Report,  Project  No,  D2000FI-0151 .001 ,  “  Validity  of  Registration  in  the 
Central  Contractor  Registration  Database,”  dated  July  26,  2002 

As  requested  in  your  July  26,  2002,  memorandum,  the  subject  audit  report  has  been 
reviewed.  Our  comments  to  Recommendation  A  and  the  Management  Control  Program  review 
are  attached. 

Finding  B  of  the  report  contained  no  recommendations.  Recommendations  were 
withheld  based  on  concurrence  by  the  Office  of  the  Secretary  of  Defense  (Comptroller)  to  DoD- 
IG  Report  D-2002-1 1 3,  and  the  subsequent  updating  of  DoD  Regulation  7000. 14-R.  The 
updates  required  the  use  of  Electronic  Funds  Transfer  (EFT)  for  all  payments  using  vendor  pay 
systems  unless  the  requirement  is  properly  waived  in  accordance  with  C.F.R.  Section  20S.4. 
Accordingly,  DFAS  has  no  additional  comments  related  to  Finding  B. 

If  you  have  additional  questions  on  this  matter,  please  contact  Mr.  LerDon  Woodfolk, 
DFAS-BSPC/CC,  at  DSN  869-6215  or  614  693-6215. 


Director,  Commercial  Pay  Services 

Attachment 
As  stated 


www.dfas.mil 

Your  Financial  Partner  @  Work 


Management  Comments  to  Department  of  Defense  Inspector  General  (DoD-IG)  Draft 
Report,  Project  No,  D2000FI-0151.001,  “Validity  of  Registration  in  the  Central  Contractor 
Registration  Database,”  dated  July  26, 2002 


Recommendation  A:  We  recommend  that  the  Director,  Commercial  Pay  Services,  Defense 
Finance  and  Accounting  Service,  establish  procedures  to  withhold  payments  to  contractors  and 
vendors  until  they  are  properly  registered  with  a  valid  Tax  Identification  Number  in  the  Central 
Contractor  Registration  database. 

Management  Comments:  Concur.  A  method  and/or  process  is  needed  to  ensure  the 
Governments  interest  is  protected  from  unlawful  misappropriation  of  funds  and  ensuring  proper 
Tax  liabilities  are  accessed  when  disbursements  are  made  to  contractors/vendors  that  are  not 
properly  registered  with  a  valid  Tax  Identification  Number  (TIN)  in  CCR.  Although  payments 
were  not  withheld  and/or  suspended  due  to  incomplete  and/or  improper  registration  in  CCR,  the 
Commercial  Pay  Business  Line  (CPBL)  mission  of  determining  contractor/vendor  entitlement 
was  not  significantly  impaired,  and  fulfillment  of  the  mission  was  not  adversely  jeopardized  in 
relation  to  the  1 ,  297  payments  reviewed  by  the  DoD-IG.  Payments  were  sent  to  the  correct 
contractors/vendors  and  instances  of  erroneous  or  duplicate  payments  were  not  noted  by  the 
DoD-IG. 

Ideally,  the  long-term  solution  is  to  implement  a  systemic  means  of  identifying 
contractors/vendors  not  properly  registered  in  the  CCR  prior  to  disbursement  of  funds. 

However,  current  system  development  and  priorities  related  to  funding  availability  and  workload 
considerations  will  dictate  whether  this  occurs.  In  the  interim,  the  following  processes  are  under 
consideration  or  have  been  implemented: 

(1)  Contract  Pav:  DFAS  Columbus  Center  is  defining,  determining 
requirements,  and  assessing  the  impact  on  operations  for  a  manual  method  using  an  existing 
query  application  (COGNOS)  specific  to  MOCAS  operations  that  will  be  designed  to  extract  an 
exception  report  for  contractors  not  properly  registered  with  a  valid  TIN  in  CCR.  This 
exception  report  will  be  the  basis,  after  verification  with  CCR,  of  withholding  contractor 
payments.  A  data  extract  of  CCR  will  be  performed,  prior  to  the  decision  to  implement  the 
query,  to  assess  the  volume  of  contractors  not  having  TINs  recorded  in  CCR,  which  will  assist 
the  Center  in  gauging  the  manual  effort  required  to  perform  the  task.  At  a  minimum,  MOCAS 
daily  disbursement  reports,  along  with  CCR,  will  be  used  to  determine  the  feasibility  of  creating 
an  exception  report  that  will  flag  contractors  not  properly  registered  with  a  valid  TIN  in  CCR. 
The  MOCAS  daily  disbursement  report  that  will  be  used  in  the  query  application  has  been 
identified;  however,  coordination  related  to  obtaining  the  proper  CCR  Database  downloads  is  in 
process. 

As  a  long-term  solution,  we  are  investigating  whether  a  system  change  can  be 
made  to  automatically  flag  and  suspend  invoices  for  which  contractors  are  not  properly 
registered  with  a  valid  TIN  in  CCR.  This  includes  determining  programming  functionality, 
availability  of  funding,  status  of  new  system  developments,  and  the  impact  on  the  legacy  system. 
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(2)  Vendor  Pay:  Vendor  Pay  (VP)  sites  employ  manual  processes  to  identify 
contractors  not  properly  registered  in  the  CCR  Database.  Upon  receipt  of  the  invoice  and  before 
input  of  the  invoice  action,  CCR/CEFT  is  verified  to  ensure  the  contractor  is  properly  registered 
in  the  CCR  Database.  A  form  letter  is  used  to  return  invoices  to  contractors  that  are  not 
registered  or  are  improperly  registered  in  CCR.  Prior  to  disbursement  of  the  contractor’s 
processed  invoice,  CCR/CEFT  is  also  verified  to  ensure  the  CCR  registration  is  still  current  and 
properly  recorded.  If  the  contractor’s  CCR  registration  is  lapsed  or  not  current,  then  the 
contractor’s  invoice  disbursement  is  withheld  until  CCR  information  is  updated. 

Based  on  the  current  efforts  to  implement  DCII  and  the  volume  of  disbursement 
transactions  reviewed  and  dollar  impact  for  the  VP  sites  that  were  noted  as  not  having  proper 
registration  in  CCR,  we  feel  that  a  long-term  systemic  solution  is  not  feasible  nor  considered  a 
viable  option  at  this  time.  The  lack  of  proper  CCR  registration  did  not  significantly  impair 
vendor  entitlement  for  the  298  Vendor  Pay  items  reviewed  by  the  DoD-IG,  and  fulfillment  of  the 
mission  was  not  adversely  jeopardized. 

To  ensure  continuous  monitoring  and  refinement  of  the  functional  processes,  we  will 
require  the  Commercial  Pay  Business  Line  include  CCR  inadequacy  in  the  appropriate 
assessable  unit  Management  Control  (MC)  matrices  (used  for  Federal  Manager’s  Financial 
Integrity  Act  compliance)  to  ensure  continuous  monitoring  and  compliance  with  the  law. 

Estimated  Completion  Date: 

(1)  Contract  Pav:  Receipt  of  the  CCR  data  and  development  of  the  query  will 
be  completed  by  December  31 , 2002.  The  decision  to  program  functionality  into  MOCAS  to 
systemically  suspend  payments  of  contractors  not  properly  registered  with  a  valid  TIN  in  CCR 
will  also  be  made  by  December  3 1 ,  2002.  Preparation,  review,  and  management  approval  of  the 
Management  Control  matrices  related  to  the  CCR  control  weakness  will  be  completed  by 
December  3 1 , 2002,  as  well. 


(2)  Vendor  Pav:  Continuous  monitoring  and  refinement  of  manual  processes 
related  to  ensuring  contractors/vendors  are  properly  registered  with  a  valid  TIN  in  CCR  is  an 
ongoing  process.  Preparation,  review,  and  management  approval  of  the  Management  Control 
matrices  related  to  the  CCR  control  weakness  will  be  completed  by  December  31,  2002. 
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Additional  Management  Comments  on  the  Management  Control  Program  Review 


Adequacy  of  Management  Controls:  The  DoD-IG  identified  material  management  control 
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